L&C offers dental hygiene care at its Paul Hanks Dental Clinic and full-service medical care at its Family Health Clinic. The Health Insurance Portability and Accountability Act ("HIPAA"), requires us to provide a summary of our privacy practices and related legal duties and an individual’s rights in connection with the use and disclosure of health information.
Personal health information of employees of L&C who participate in dental and medical health plans and the Employee Assistance Program (EAP) is also protected by HIPAA.
Effective Date: April 14, 2004
Lewis & Clark Community College Employee Health Plan
Notice of Privacy Practices
General Information About This Notice
Lewis & Clark Community College ("L&C") continues its commitment to maintaining the confidentiality of your private medical information. This Notice describes our efforts to safeguard your health information from improper or unnecessary use or disclosure. This Notice only applies to health-related information received by or on behalf of the group health plans sponsored by L&C, including the plans offering medical, dental and vision benefits, and the Employee Assistance Program ("EAP") (collectively the "Health Plan"). A new federal law, the Health Insurance Portability and Accountability Act ("HIPAA"), requires us to provide you with a summary of the Health Plan’s privacy practices and related legal duties, and your rights in connection with the use and disclosure of your health information.
This Notice applies to L&C employees, former employees, and dependents who participate in the Health Plan, including the EAP.
Please note: This Notice does not apply to an HMO or fully insured medical, vision, dental, or prescription drug benefit options. If you are enrolled in an HMO or fully insured program, you will receive a separate notice from your HMO or insurance provider. However, this Notice applies to the extent any protected health information or "PHI" from an HMO or insurer offering benefits under a Heath Plan is disclosed to the Health Plan.
In this Notice, the terms "we," "us," and "our" refer to the Health Plan, all L&C employees involved in the administration of the Health Plan, and all third parties who perform services for the Health Plan.
CONTACT INFORMATION If you have any questions regarding this Notice, please contact:
Lewis and Clark Community College Human Resources Department
Attn: HIPAA Privacy Officer 5800 Godfrey Road Godfrey, Illinois 62035-2466 (618) 468-3000
E-mail: Privacy@lc.edu
What is Protected?
HIPAA requires the Health Plan to have a special policy for safeguarding PHI received or created in the course of administering the Health Plan. PHI is health information that can be used to identify you and that relates to:
- your physical or mental health condition, - the provision of health care to you, or - payment for your health care.
Your participant intake form in connection with benefits under the EAP is an example of PHI. Employment records maintained by L&C in its capacity as an employer are not PHI.
If L&C obtains your health information in another way – for example, if you are hurt in a work accident or if you provide medical records with your request for Family and Medical Leave Act (FMLA) absence, then L&C will safeguard that information in accordance with the applicable laws. Similarly, health information obtained by a non-health-related benefits program, such as a long-term disability program is not protected under this Notice. This Notice does not apply in those types of situations because the health information is not received or created in connection with the Health Plan.
The remainder of this Notice generally describes our rules with respect to your PHI received or created by the Health Plan.
Primary Uses and Disclosures of Your PHI
To protect the privacy of your PHI, the Health Plan not only guards the physical security of your PHI, but also limits the way your PHI is used or disclosed to others. We may use or disclose your PHI in certain permissible ways described below. To the extent required under HIPAA, we will use the minimum amount of your PHI necessary to perform these tasks:
Treatment, Payment and Healthcare Operations
The Health Plan may use and disclose your PHI for treatment, payment and health care operations as described in HIPAA.
- Treatment. We may use or disclose your PHI so that you may be provided with health care and related services. For example, we may disclose to a specialist the name of your primary care physician so that the specialist may request medical records from your primary care physician
- Payment. We may use or disclose your PHI to reimburse you or your healthcare provider for covered treatments and services. We may also use or disclose PHI to obtain reimbursement from a stop-loss carrier or to fulfill our responsibilities for providing benefits. For example, we may disclose your PHI to a provider requesting information as to your eligibility for coverage under the Health Plan.
- Health Care Operations. We may use or disclose your PHI for various administrative and quality control functions necessary for the Health Plan’s proper operation. Healthcare operations include, but are not limited to, quality assessment and improvement, reviewing provider performance, licensing, stop-loss underwriting, business planning and business development.
Business Associates
The Health Plan contracts with third-party service providers ("business associates") to perform various functions on behalf of the Health Plan. To perform these functions, our business associates may receive, create, maintain, use or disclose PHI, but only after we require the business associate to agree in writing to safeguard your PHI. For example, we may disclose PHI to a business associate so that the business associate may administer claims.
Other Covered Entities
We may use or disclose your PHI to assist healthcare providers in connection with their treatment or payment activities. For example, we may disclose your PHI to a health care provider when needed by the provider to render treatment to you, or we may exchange your PHI with another covered entity for coordination of benefits purposes. We may also share your PHI with another health plan or health care provider who has a relationship with you for quality assessment and improvement activities, to review the qualifications of health care professionals who provide services to you, or for fraud and abuse detection and prevention purposes.
Plan Sponsor
We may disclose your PHI to the plan sponsor (i.e., L&C) for purposes of plan administration or pursuant to an authorization signed by you. We may also disclose "summary health information" to the plan sponsor so that the plan sponsor may obtain premium bids or modify, amend or terminate a group health plan. Summary health information summarizes the claims history, claims expenses or types of claims experienced by individuals under a group health plan and from which identifying information has been deleted.
Other Possible Uses and Disclosures of PHI
To a family member, friend, or other person involved in your health care if you do not object (or if it can be inferred that you do not object) to the sharing of your PHI, or if you are not present or unable to object due to incapacity or emergency, and the disclosure is in your best interests. Only PHI that we determine is directly relevant to the person’s involvement with your health care or payment for health care will be disclosed. Your PHI may be shared with your personal representative. For children, a parent is usually a personal representative.
To comply with an applicable federal, state, or local law, including workers’ compensation or similar programs.
For public health reasons, including (1) to a public health authority for the prevention or control of disease, injury or disability; (2) to a proper government or health authority to report child abuse or neglect; (3) to report reactions to medications or problems with products regulated by the Food and Drug Administration; (4) to notify individuals of recalls of medication or products they may be using; or (5) to notify a
person who may have been exposed to a communicable disease or who may be at risk for contracting or spreading a disease or condition.
To report a suspected case of abuse, neglect or domestic violence, as permitted or required by applicable law.
To comply with health oversight activities, such as audits, investigations, inspections, licensure actions, and other government monitoring and activities related to health care provision or public benefits or services.
To the U.S. Department of Health and Human Services to demonstrate our compliance with federal health information privacy law.
To respond to an order of a court or administrative tribunal.
To respond to a subpoena, warrant, summons or other legal requests if sufficient safeguards, such as a protective order, are in place to maintain your PHI privacy.
To a law enforcement official for a law enforcement purpose.
For purposes of public safety or national security.
To allow a coroner or medical examiner to identify you or determine your cause of death.
To allow a funeral director to carry out his or her duties.
To respond to a request by military command authorities if you are or were a member of the armed forces.
Authorized Uses and Disclosures of PHI
Before we use or disclose your PHI for any other purpose, including any employment-related reason, we must obtain your written authorization. You can obtain a form of authorization from the contact shown on the first page of this Notice. You may revoke your authorization, in writing, at any time. If you revoke your authorization, the Health Plan will no longer use or disclose your PHI except as described above (or as permitted by any other authorizations that have not been revoked). However, please understand that we cannot retrieve any PHI disclosed to a third party in reliance on your prior authorization.
You may also use written authorization to allow another person, such as your spouse, parent or other representative, to obtain or use your PHI.
State Law
State law may further limit the permissible ways the Health Plan uses or discloses your PHI. If an applicable state law imposes stricter restrictions on the Health Plan, we will comply with such applicable state law.
Your Rights
Federal law provides you with certain rights regarding your PHI. Parents of minor children and other individuals with legal authority to make health decisions for a Health Plan participant may exercise these rights on behalf of the participant, consistent with state law.
Right to Request Restrictions
You have the right to request a restriction or limitation on the Health Plan’s use or disclosure of your PHI. Because we use your PHI only as necessary to pay Health Plan benefits, to administer the Health Plan, and to comply with the law, it may not be possible to agree to your request. The law does not require the Health Plan to agree to your request for restriction. However, if we do agree to your requested restriction or limitation, we will honor the restriction until you agree to terminate the restriction or until we notify you that we are terminating the restriction on a going-forward basis.
Restriction request forms are available from the HIPAA Privacy Officer. You may make a request for restriction on the use and disclosure of your PHI to the HIPAA Privacy Officer. Contact information for the HIPAA Privacy Officer is listed on the front page of this Notice. When making such a request, you must specify: (1) the PHI you want to limit; (2) how you want the Health Plan to limit the use, disclosure, or both of that PHI; and (3) to whom you want the restrictions to apply.
Right to Receive Confidential Communications
You have the right to request that the Health Plan communicate with you about your PHI at an alternative address or by alternative means if you believe that communication through normal business practices could endanger you. For example, you may request that the Health Plan contact you only at work and not at home.
You may request confidential communication of your PHI by completing the appropriate form available from the HIPAA Privacy Officer. You should send your written request for confidential communication to the HIPAA Privacy Officer at the address listed on the front page of this Notice. We will accommodate all reasonable requests if you clearly state that you are requesting the confidential communication because you feel that disclosure in another way could endanger your safety. You must make sure your request specifies how or where you wish to be contacted.
Right to Inspect and Copy Your PHI
You have the right to inspect and copy your PHI that is contained in records that the Health Plan maintains for enrollment, payment, claim determinations or that we use to make enrollment, coverage, or payment decisions about you.
However, we will not give you access to PHI records created in anticipation of a civil, criminal, or administrative action or proceeding. We will also deny your request to inspect and copy your PHI if a licensed healthcare professional hired by the Health Plan has determined that giving you the requested access is reasonably likely to endanger the life or physical safety of you or another individual or to cause substantial harm to you or another individual, or that the record makes references to another person (other than a health care provider), and that the requested access would likely cause substantial harm to the other person.
In the unlikely event that your request to inspect or copy your PHI is denied, you may have that decision reviewed. A different licensed healthcare professional chosen by the Health Plan will review the request and denial, and we will comply with the healthcare professional’s decision.
You may request to inspect or copy your PHI by completing the appropriate form available from the HIPAA Privacy Officer. Your written request should be sent to the HIPAA Privacy Officer at the address listed on the front page of this Notice. We may
charge you a fee to cover the costs of copying, mailing or other supplies directly associated with your request. You will be notified of any costs before you incur any expenses.
Right to Amend Your PHI
You have the right to request an amendment of your PHI if you believe the information the Health Plan has about you is incorrect or incomplete. You have this right as long as your PHI is maintained by the Health Plan. We will correct any mistakes if we created the PHI or if the person or entity that originally created the PHI is no longer available to make the amendment.
You may request amendments of your PHI by completing the appropriate form available from the HIPAA Privacy Officer. Your written request to amend your PHI should be sent to the HIPAA Privacy Officer at the address listed on the front page of this Notice. Be sure to include evidence to support your request because we cannot amend PHI that we believe to be accurate and complete.
Right to Receive an Accounting of Disclosures
You have the right to request a list of certain disclosures of your PHI by the Health Plan. The accounting will not include (1) disclosures necessary to determine proper payment of benefits or to operate the Health Plan, (2) disclosures we make to you, (3) disclosures permitted by your authorization, (4) disclosures to friends or family members made in your presence or because of an emergency, or (5) disclosures for national security purposes. Your first request for an accounting within a 12-month period will be free. We may charge you for costs associated with providing you additional accountings. We will notify you of the costs involved, and you may choose to withdraw or modify your request before you incur any expenses.
Accounting request forms are available from the HIPAA Privacy Officer. You may request an accounting of disclosures of your PHI from the HIPAA Privacy Officer. Contact information for the HIPAA Privacy Officer is listed on the front page of this Notice. When making such a request, you must specify the time period for the accounting, which may not be longer than six (6) years and may not include dates prior to April 14, 2004, and the form (e.g., electronic, paper) in which you would like the accounting.
Right to File a Complaint
If you believe your rights have been violated, you should let us know immediately. We will take steps to remedy any violations of the Health Plan’s privacy policy or of this Notice.
You may file a formal complaint with our HIPAA Privacy Officer and/or with the United States Department of Health and Human Services as explained at http://www.hhs.gov/ocr/hipaa. You should attach any documents or evidence that supports your belief that your privacy rights have been violated. We take your complaints very seriously.
Complaints should be sent to:
Lewis & Clark Community College Human Resources Department A
Attn: HIPAA Privacy Officer 5800 Godfrey Road
Godfrey, Illinois 62035-2466 (618) 468-3000
E-mail: Privacy@lc.edu
U.S. Department of Health and Human Services OCR Regional Office identified at http://www.hhs.gov/ocr/hipaa
E-mail: OCRComplaint@hhs.gov
L&C prohibits retaliation against any person for filing such a complaint.
Additional Information About This Notice
Changes to this Notice: We reserve the right to change the Health Plan’s privacy practices as described in this Notice. Any change may affect the use and disclosure of your PHI already maintained by the Health Plan, as well as any of your PHI that the Health Plan may receive or create in the future. If there is a material change to the terms of this Notice, you will automatically receive a revised Notice.
How to obtain a copy of this Notice: You can obtain a copy of the current Notice by writing to the HIPAA Privacy Officer at the address listed on the front page of this Notice.
No guarantee of employment: This Notice does not create any right to employment for any individual, nor does it change L&C’s right to discipline or discharge any of its employees in accordance with its applicable policies and procedures.
No change to Health Plan benefits: This Notice explains your privacy rights as a current or former participant in the Health Plan. The Health Plan is bound by the terms of this Notice as they relate to the privacy of your protected health information. However, this Notice does not change any other rights or obligations you may have under the Health Plan. You should refer to the Health Plan documents for additional information regarding your Health Plan benefits.